6556 matches found
CVE-2024-7035 Cross-Site Request Forgery (CSRF) in open-webui/open-webui
In version v0.3.8 of open-webui/open-webui, sensitive actions such as deleting and resetting are performed using the GET method. This vulnerability allows an attacker to perform Cross-Site Request Forgery CSRF attacks, where an unaware user can unintentionally perform sensitive actions by simply...
CVE-2024-10361 Arbitrary File Deletion via Path Traversal in danny-avila/librechat
An arbitrary file deletion vulnerability exists in danny-avila/librechat version v0.7.5-rc2, specifically within the /api/files endpoint. This vulnerability arises from improper input validation, allowing path traversal techniques to delete arbitrary files on the server. Attackers can exploit thi...
CVE-2024-10361
The CVE-2024-10361 entry concerns a vulnerability in danny-avila/librechat v0.7.5-rc2 where the /api/files endpoint allows path traversal due to improper input validation, enabling arbitrary file deletion on the server. Affected component: the API files handling logic in LibreChat. Reported impac...
polyaxon 安全漏洞
Polyaxon is an open source platform designed to simplify the lifecycle management of machine learning and deep learning projects. Polyaxon suffers from a container escape vulnerability that can be exploited by attackers to compromise the confidentiality, availability, and integrity of the system...
PT-2025-62963
Name of the Vulnerable Software and Affected Versions Kaiten versions 57.192.20 through 57.214.25 Description The Hibernate request service in the project management tool contains a flaw where dynamic SQL statements are generated without proper data validation, parameterized statements, or stored...
mtk_drm_bind Heap Buffer Overflow DoS
Vulnerability of the mtkdrmbind function in the drivers/gpu/drm/mediatek/mtkdrmdrv.c module – The DRI driver for Mediatek graphics cards in Linux operating systems relies on the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the...
Critical vulnerabilities in SICK DL100-2xxxxxxx
Critical vulnerabilities have been found in the SICK device DL100-2xxxxxxx. If exploited, this potentially allows an attacker to impact availabiltiy, integrity and confidentaility of the products. Currently, SICK is not aware of any public exploits specifically targeting these vulnerabilities. As...
CVE-2024-54085
AMI’s SPx contains a vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability...
CVE-2025-26661
Due to missing authorization check, SAP NetWeaver ABAP Class Builder allows an attacker to gain higher access levels than they should have, resulting in escalation of privileges. On successful exploitation, this could result in disclosure of highly sensitive information. It could also have a high...
CVE-2025-26661 Missing Authorization check in SAP NetWeaver (ABAP Class Builder)
Due to missing authorization check, SAP NetWeaver ABAP Class Builder allows an attacker to gain higher access levels than they should have, resulting in escalation of privileges. On successful exploitation, this could result in disclosure of highly sensitive information. It could also have a high...
CVE-2025-26661 Missing Authorization check in SAP NetWeaver (ABAP Class Builder)
Due to missing authorization check, SAP NetWeaver ABAP Class Builder allows an attacker to gain higher access levels than they should have, resulting in escalation of privileges. On successful exploitation, this could result in disclosure of highly sensitive information. It could also have a high...
CVE-2025-25245 Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence)
SAP BusinessObjects Business Intelligence Platform Web Intelligence contains a deprecated web application endpoint that is not properly secured. An attacker could take advantage of this by injecting a malicious url in the data returned to the user. On successful exploitation, there could be a...
CVE-2024-58048
Multi-thread problem vulnerability in the package management module Impact: Successful exploitation of this vulnerability may affect availability...
CVE-2024-58045
Multi-concurrency vulnerability in the media digital copyright protection module Impact: Successful exploitation of this vulnerability may affect availability...
CVE-2024-51947
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required...
CVE-2024-51945
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required...
CVE-2024-58048
Multi-thread problem vulnerability in the package management module Impact: Successful exploitation of this vulnerability may affect availability...
CVE-2024-58048
Multi-thread problem vulnerability in the package management module Impact: Successful exploitation of this vulnerability may affect availability...